SUMMARY when overview is mapped a modifier only shortcut, it works even at the lock screen, thus the user's current windows and their contents are exposed. STEPS TO REPRODUCE 1. enable the overview effect 2. lock the screen(default : Meta+L) 3. activate overview effect via a modifier-only-shortcut OBSERVED RESULT overview effect activates, the contents of all windows in the current desktop session are shown. overview itself is unresponsive to user input. In addition, the CPU seems to overheat. EXPECTED RESULT overview effect should not activate when the user is unauthenticated. SOFTWARE/OS VERSIONS Windows: macOS: Linux/KDE Plasma: (available in About System) KDE Plasma Version: 5.24.1 KDE Frameworks Version: 5.91.0 Qt Version: 5.15.2 ADDITIONAL INFORMATION in kwinrc: [ModifierOnlyShortcuts] Alt= Control= Meta=org.kde.kglobalaccel,/component/kwin,,invokeShortcut,Overview Shift=
Cannot reproduce on Wayland, trying on X11...
Can reproduce on X11. Raising priority and severity due to the security implications.
We don't expose that in a GUI option anywhere. Still worth fixing, but not worth being too worried about it.
A possibly relevant merge request was started @ https://invent.kde.org/plasma/kwin/-/merge_requests/2034
Git commit aab395f07bcfeca487b7736ddc10902d8510768c by Vlad Zahorodnii, on behalf of David Edmundson. Committed on 17/02/2022 at 13:01. Pushed by vladz into branch 'master'. Check lockscreen status for fullscreen effects Whilst global shortcuts are blocked by grabbing the keyboard, user set up manual scripts can still invoke a global action. Given we already have code to deactivate when locking it makes sense to also prevent activation. M +3 -0 src/effects/desktopgrid/desktopgrid.cpp M +3 -0 src/effects/overview/overvieweffect.cpp M +3 -0 src/effects/presentwindows/presentwindows.cpp https://invent.kde.org/plasma/kwin/commit/aab395f07bcfeca487b7736ddc10902d8510768c
Git commit 39153cf77aac120476402b21c9fdd357ec1d40ce by Vlad Zahorodnii, on behalf of David Edmundson. Committed on 17/02/2022 at 13:51. Pushed by vladz into branch 'Plasma/5.24'. Check lockscreen status for fullscreen effects Whilst global shortcuts are blocked by grabbing the keyboard, user set up manual scripts can still invoke a global action. Given we already have code to deactivate when locking it makes sense to also prevent activation. (cherry picked from commit aab395f07bcfeca487b7736ddc10902d8510768c) M +3 -0 src/effects/desktopgrid/desktopgrid.cpp M +3 -0 src/effects/overview/overvieweffect.cpp M +3 -0 src/effects/presentwindows/presentwindows.cpp https://invent.kde.org/plasma/kwin/commit/39153cf77aac120476402b21c9fdd357ec1d40ce